/*     */ package com.zimbra.cs.account.accesscontrol;
/*     */ 
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.AccessManager.ViaGrant;
/*     */ import com.zimbra.cs.account.DistributionList;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.Group;
/*     */ import com.zimbra.cs.account.MailTarget;
/*     */ import com.zimbra.cs.account.Provisioning;
/*     */ import com.zimbra.cs.account.Provisioning.GroupMembership;
/*     */ import com.zimbra.cs.account.Provisioning.MemberOf;
/*     */ import java.util.List;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class CheckPresetRight
/*     */   extends CheckRight
/*     */ {
/*  40 */   private static final Log sLog = ZimbraLog.acl;
/*     */   
/*     */   private final MailTarget mGranteeMailTarget;
/*     */   private final AccessManager.ViaGrant mVia;
/*     */   private Provisioning.GroupMembership mGranteeGroups;
/*     */   private final SeenRight mSeenRight;
/*     */   
/*     */   private static class SeenRight
/*     */   {
/*     */     private boolean mSeen;
/*     */     
/*     */     void setSeenRight()
/*     */     {
/*  53 */       this.mSeen = true;
/*     */     }
/*     */     
/*     */     boolean seenRight() {
/*  57 */       return this.mSeen;
/*     */     }
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public static Boolean check(MailTarget grantee, Entry target, Right rightNeeded, boolean canDelegateNeeded, AccessManager.ViaGrant via)
/*     */     throws ServiceException
/*     */   {
/*  79 */     PermissionCache.CachedPermission cached = null;
/*     */     
/*  81 */     if (via == null) {
/*  82 */       cached = PermissionCache.cacheGet(grantee, target, rightNeeded, canDelegateNeeded);
/*     */     }
/*     */     
/*     */     Boolean allowed;
/*     */     
/*  87 */     if ((cached == null) || (cached == PermissionCache.CachedPermission.NOT_CACHED)) {
/*  88 */       CheckPresetRight checker = new CheckPresetRight(grantee, target, rightNeeded, canDelegateNeeded, via);
/*     */       
/*  90 */       Boolean allowed = checker.checkRight();
/*  91 */       PermissionCache.cachePut(grantee, target, rightNeeded, canDelegateNeeded, allowed);
/*     */     } else {
/*  93 */       allowed = cached.getResult();
/*     */     }
/*     */     
/*  96 */     if (sLog.isDebugEnabled()) {
/*  97 */       sLog.debug("check ACL: " + (allowed == null ? "no matching ACL" : allowed) + "(target=" + target.getLabel() + ", grantee=" + grantee.getName() + ", right=" + rightNeeded.getName() + ", canDelegateNeeded=" + canDelegateNeeded + ")");
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 103 */     return allowed;
/*     */   }
/*     */   
/*     */   private CheckPresetRight(MailTarget grantee, Entry target, Right rightNeeded, boolean canDelegateNeeded, AccessManager.ViaGrant via)
/*     */     throws ServiceException
/*     */   {
/* 109 */     super(target, rightNeeded, canDelegateNeeded);
/*     */     
/* 111 */     this.mGranteeMailTarget = grantee;
/* 112 */     this.mVia = via;
/* 113 */     this.mTargetType = TargetType.getTargetType(this.mTarget);
/* 114 */     this.mSeenRight = new SeenRight(null);
/*     */   }
/*     */   
/*     */ 
/*     */   private Provisioning.GroupMembership getGranteeGroups()
/*     */     throws ServiceException
/*     */   {
/* 121 */     if (this.mGranteeGroups == null)
/*     */     {
/*     */ 
/* 124 */       boolean adminGroupsOnly = !this.mRightNeeded.isUserRight();
/* 125 */       this.mGranteeGroups = this.mProv.getGroupMembership(this.mGranteeMailTarget, adminGroupsOnly);
/* 126 */       if ((this.mGranteeMailTarget instanceof DistributionList)) {
/* 127 */         DistributionList dlmt = (DistributionList)this.mGranteeMailTarget;
/* 128 */         if ((!adminGroupsOnly) || (dlmt.isIsAdminGroup())) {
/* 129 */           this.mGranteeGroups.append(new Provisioning.MemberOf(dlmt.getId(), dlmt.isIsAdminGroup(), false), dlmt.getId());
/*     */         }
/*     */       }
/*     */     }
/*     */     
/* 134 */     return this.mGranteeGroups;
/*     */   }
/*     */   
/*     */   private boolean matchesGroupGrantee(ZimbraACE ace) throws ServiceException {
/* 138 */     if (getGranteeGroups().groupIds().contains(ace.getGrantee()))
/* 139 */       return true;
/* 140 */     if (ace.getGranteeType() == GranteeType.GT_EXT_GROUP) {
/* 141 */       return ace.matchesGrantee(this.mGranteeMailTarget, !this.mRightNeeded.isUserRight());
/*     */     }
/* 143 */     return false;
/*     */   }
/*     */   
/*     */   private Boolean checkRight()
/*     */     throws ServiceException
/*     */   {
/* 149 */     if (!this.mRightNeeded.isPresetRight()) {
/* 150 */       throw ServiceException.INVALID_REQUEST("RightChecker.canDo can only check preset right, right " + this.mRightNeeded.getName() + " is a " + this.mRightNeeded.getRightType() + " right", null);
/*     */     }
/*     */     
/*     */ 
/* 154 */     boolean adminRight = !this.mRightNeeded.isUserRight();
/*     */     
/* 156 */     Domain granteeDomain = null;
/*     */     
/* 158 */     if (adminRight)
/*     */     {
/* 160 */       if (!RightBearer.isValidGranteeForAdminRights(GranteeType.GT_USER, this.mGranteeMailTarget)) {
/* 161 */         return null;
/*     */       }
/*     */       
/* 164 */       granteeDomain = this.mProv.getDomain(this.mGranteeMailTarget);
/*     */       
/* 166 */       if (granteeDomain == null) {
/* 167 */         throw ServiceException.FAILURE("internal error, cannot find domain for " + this.mGranteeMailTarget.getName(), null);
/*     */       }
/*     */       
/*     */ 
/*     */ 
/* 172 */       if (this.mRightNeeded == Rights.Admin.R_crossDomainAdmin) {
/* 173 */         return CrossDomain.checkCrossDomainAdminRight(this.mProv, granteeDomain, this.mTarget, this.mCanDelegateNeeded);
/*     */       }
/*     */     }
/*     */     
/*     */ 
/* 178 */     Boolean result = null;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 185 */     List<ZimbraACE> acl = ACLUtil.getAllACEs(this.mTarget);
/* 186 */     if (acl != null) {
/* 187 */       result = checkTarget(acl, false);
/* 188 */       if (result != null) {
/* 189 */         return result;
/*     */       }
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 197 */     Domain targetDomain = TargetType.getTargetDomain(this.mProv, this.mTarget);
/*     */     
/*     */ 
/* 200 */     boolean expandTargetGroups = CheckRight.allowGroupTarget(this.mRightNeeded);
/*     */     
/*     */ 
/* 203 */     TargetIterator iter = TargetIterator.getTargetIeterator(this.mProv, this.mTarget, expandTargetGroups);
/*     */     
/*     */ 
/* 206 */     GroupACLs groupACLs = null;
/*     */     Entry grantedOn;
/* 208 */     while ((grantedOn = iter.next()) != null) {
/* 209 */       acl = ACLUtil.getAllACEs(grantedOn);
/*     */       
/* 211 */       if ((grantedOn instanceof Group)) {
/* 212 */         if (acl != null)
/*     */         {
/*     */ 
/*     */ 
/* 216 */           boolean skipPositiveGrants = false;
/* 217 */           if (adminRight) {
/* 218 */             skipPositiveGrants = !CrossDomain.crossDomainOK(this.mProv, this.mGranteeMailTarget, granteeDomain, targetDomain, (Group)grantedOn);
/*     */           }
/*     */           
/*     */ 
/*     */ 
/* 223 */           if (groupACLs == null) {
/* 224 */             groupACLs = new GroupACLs(this.mTarget);
/*     */           }
/* 226 */           groupACLs.collectACL((Group)grantedOn, skipPositiveGrants);
/*     */         }
/*     */         
/*     */       }
/*     */       else
/*     */       {
/* 232 */         if (groupACLs != null) {
/* 233 */           List<ZimbraACE> aclsOnGroupTargets = groupACLs.getAllACLs();
/* 234 */           if (aclsOnGroupTargets != null) {
/* 235 */             result = checkTarget(aclsOnGroupTargets, false);
/*     */           }
/* 237 */           if (result != null) {
/* 238 */             return result;
/*     */           }
/*     */           
/*     */ 
/* 242 */           groupACLs = null;
/*     */         }
/*     */         
/*     */ 
/* 246 */         if (acl != null)
/*     */         {
/*     */ 
/*     */ 
/* 250 */           boolean subDomain = (this.mTargetType == TargetType.domain) && ((grantedOn instanceof Domain));
/* 251 */           result = checkTarget(acl, subDomain);
/* 252 */           if (result != null) {
/* 253 */             return result;
/*     */           }
/*     */         }
/*     */       }
/*     */     }
/* 258 */     if (this.mSeenRight.seenRight()) {
/* 259 */       return Boolean.FALSE;
/*     */     }
/* 261 */     return null;
/*     */   }
/*     */   
/*     */   private Boolean checkTarget(List<ZimbraACE> acl, boolean subDomain)
/*     */     throws ServiceException
/*     */   {
/* 267 */     Boolean result = null;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 272 */     short adminFlag = this.mRightNeeded.isUserRight() ? 0 : 1;
/*     */     
/*     */ 
/* 275 */     result = checkPresetRight(acl, (short)(0x2 | adminFlag), subDomain);
/* 276 */     if (result != null) {
/* 277 */       return result;
/*     */     }
/*     */     
/*     */ 
/* 281 */     result = checkGroupPresetRight(acl, (short)4, subDomain);
/* 282 */     if (result != null) {
/* 283 */       return result;
/*     */     }
/*     */     
/*     */ 
/* 287 */     if (this.mRightNeeded.isUserRight())
/*     */     {
/* 289 */       result = checkPresetRight(acl, (short)8, subDomain);
/* 290 */       if (result != null) {
/* 291 */         return result;
/*     */       }
/*     */       
/*     */ 
/* 295 */       result = checkPresetRight(acl, (short)16, subDomain);
/* 296 */       if (result != null) {
/* 297 */         return result;
/*     */       }
/*     */       
/*     */ 
/* 301 */       result = checkPresetRight(acl, (short)32, subDomain);
/* 302 */       if (result != null) {
/* 303 */         return result;
/*     */       }
/*     */     }
/*     */     
/* 307 */     return null;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private boolean matchesPresetRight(ZimbraACE ace, short granteeFlags, boolean subDomain)
/*     */     throws ServiceException
/*     */   {
/* 329 */     GranteeType granteeType = ace.getGranteeType();
/* 330 */     if (!granteeType.hasFlags(granteeFlags)) {
/* 331 */       return false;
/*     */     }
/*     */     
/* 334 */     if (!CheckRight.rightApplicableOnTargetType(this.mTargetType, this.mRightNeeded, this.mCanDelegateNeeded)) {
/* 335 */       return false;
/*     */     }
/*     */     
/* 338 */     if ((this.mCanDelegateNeeded) && (ace.canExecuteOnly())) {
/* 339 */       return false;
/*     */     }
/*     */     
/*     */ 
/* 343 */     if ((!ace.deny()) && 
/* 344 */       (subDomain != ace.subDomain())) {
/* 345 */       return false;
/*     */     }
/*     */     
/*     */ 
/* 349 */     Right rightGranted = ace.getRight();
/* 350 */     if (((rightGranted.isPresetRight()) && (rightGranted == this.mRightNeeded)) || ((rightGranted.isComboRight()) && (((ComboRight)rightGranted).containsPresetRight(this.mRightNeeded))))
/*     */     {
/* 352 */       return true;
/*     */     }
/*     */     
/* 355 */     return false;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private Boolean checkPresetRight(List<ZimbraACE> acl, short granteeFlags, boolean subDomain)
/*     */     throws ServiceException
/*     */   {
/* 387 */     Boolean result = null;
/* 388 */     for (ZimbraACE ace : acl) {
/* 389 */       if (matchesPresetRight(ace, granteeFlags, subDomain))
/*     */       {
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 395 */         this.mSeenRight.setSeenRight();
/*     */         
/* 397 */         if (ace.matchesGrantee(this.mGranteeMailTarget, !this.mRightNeeded.isUserRight())) {
/* 398 */           return gotResult(ace);
/*     */         }
/*     */       }
/*     */     }
/* 402 */     return result;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private Boolean checkGroupPresetRight(List<ZimbraACE> acl, short granteeFlags, boolean subDomain)
/*     */     throws ServiceException
/*     */   {
/* 422 */     Boolean result = null;
/*     */     
/* 424 */     for (ZimbraACE ace : acl) {
/* 425 */       if (matchesPresetRight(ace, granteeFlags, subDomain))
/*     */       {
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 431 */         this.mSeenRight.setSeenRight();
/*     */         
/* 433 */         if (matchesGroupGrantee(ace))
/* 434 */           return gotResult(ace);
/*     */       }
/*     */     }
/* 437 */     return result;
/*     */   }
/*     */   
/*     */   private Boolean gotResult(ZimbraACE ace) throws ServiceException {
/* 441 */     if (ace.deny()) {
/* 442 */       if (sLog.isDebugEnabled()) {
/* 443 */         sLog.debug("Right [%s] DENIED to %s via grant: %s on: %s=%s", new Object[] { this.mRightNeeded.getName(), this.mGranteeMailTarget.getName(), ace.dump(false), ace.getTargetType().getCode(), ace.getTargetName() });
/*     */       }
/*     */       
/*     */ 
/*     */ 
/* 448 */       if (this.mVia != null) {
/* 449 */         this.mVia.setImpl(new ViaGrantImpl(ace.getTargetType(), ace.getTargetName(), ace.getGranteeType(), ace.getGranteeDisplayName(), ace.getRight(), ace.deny()));
/*     */       }
/*     */       
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 457 */       return Boolean.FALSE;
/*     */     }
/* 459 */     if (sLog.isDebugEnabled()) {
/* 460 */       sLog.debug("Right [%s] ALLOWED to %s via grant: %s on: %s=%s", new Object[] { this.mRightNeeded.getName(), this.mGranteeMailTarget.getName(), ace.dump(false), ace.getTargetType().getCode(), ace.getTargetName() });
/*     */     }
/*     */     
/*     */ 
/*     */ 
/* 465 */     if (this.mVia != null) {
/* 466 */       this.mVia.setImpl(new ViaGrantImpl(ace.getTargetType(), ace.getTargetName(), ace.getGranteeType(), ace.getGranteeDisplayName(), ace.getRight(), ace.deny()));
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 474 */     return Boolean.TRUE;
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/accesscontrol/CheckPresetRight.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */